Search code examples
tcpsmtpwiresharksmtps

How does Wireshark judge whether a protocol is SMTP or TCP through the header field?

I know that SMTP is based on TCP, like HTTP, but how does Wireshark judge it as SMTP rather than TCP?

Solution

  • How does Wireshark judge it as SMTP rather than TCP?

    It doesn't. SMTP is inside the payload of a TCP packet. So Wireshark will first dissect TCP and if it has dissectors available to parse the payload, it will also parse that, like SMTP in this case. In conclusion, your "SMTP packet" is also a TCP packet. E. g., you can filter your SMTP packets by TCP attributes like ports.